Overview

overview

10

Static

static

5

0521690.exe

windows7-x64

10

0521690.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24092024_1246_23092024_0521690.xxe

  • Size

    742KB

  • Sample

    240924-pzw8nsyemg

  • MD5

    9686927c6b3dd42d2622add5c6cda87b

  • SHA1

    26f15dc857a5decd732e098ebbab98615a44f9ca

  • SHA256

    2bb8a137cd9f2dd2c6fb758c10760a8295ca9015bf5f4eb2ba05299939d046d2

  • SHA512

    5b313bed9bd2874d115f7da119575ffdbbd5108cc5ab3067f78354b3db917c838c81200a3fe5ed53be00f5296313ddd7377c472445bc10d7cda2fce518a47137

  • SSDEEP

    12288:5OEaiY/V8A6D2mIUC9Swl1pIveW70gJrWcvWfn0HbwaawZ4yiqaUcIwVnjlFIOxy:3aiYNukTH1pceW7hbhZ4yBa5I8nj4Oxy

Score
10/10
agenttesladiscoverykeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      0521690.bat

    • Size

      77.0MB

    • MD5

      c39a48ee3a85d4fc36fb52f723ebde61

    • SHA1

      921d4129c27baca0ebc29997da69dc79977c73ea

    • SHA256

      812d7e9c33df186a4d4973e7433caff8a16f4fd7f66c1d1bb54c25d57b8b9c7c

    • SHA512

      50fcb27ad58bcea345b6593c866301736fa4a7e71e5607f1b60fb75ec6ec0bad3d311bdb017142cb7ed5f2e439f8022f0085a7d20fd9564a93b3f462b3dc2a6a

    • SSDEEP

      24576:uRmJkcoQricOIQxiZY1iaCTUQ3aWhG0S0aj9kJGofD4:7JZoQrbTFZY1iaCTus1hGoM

    Score
    10/10
    agenttesladiscoverykeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks